CVE-2026-47291

Windows HTTP.sys is a core “traffic director” that handles web/network requests in Windows. This flaw is caused by an integer math mistake that can be tricked into behaving incorrectly, and that can let an attacker get their code to run. Think of it like a highway toll machine that miscalculates change under certain conditions—an attacker can manipulate the input to make the system do the wrong thing.

This matters to you if you run or rely on these systems for business operations: Microsoft Windows 10 1607, 1809, 21h2, 22h2, and Microsoft Windows 11 23h2, 24h2, 25h2, 26h1. It also affects Microsoft Windows Server 2012 and Microsoft Windows Server 2016. If any of these machines are exposed to the internet or connected networks where attackers could reach them, you’re in the risk zone.

This is RED because exploitation is reported “itw” (in the wild), including sustained press attention. That means attackers are actively looking for vulnerable systems right now, so waiting increases the chance you get hit. Prioritize patching as soon as possible and make sure exposure is reduced until updates are applied.